diff options
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/logical-replication.sgml | 17 | ||||
| -rw-r--r-- | doc/src/sgml/ref/alter_subscription.sgml | 3 | ||||
| -rw-r--r-- | doc/src/sgml/ref/create_subscription.sgml | 14 |
3 files changed, 33 insertions, 1 deletions
diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgml index 90f39676632..c65f4aabfd7 100644 --- a/doc/src/sgml/logical-replication.sgml +++ b/doc/src/sgml/logical-replication.sgml @@ -1786,6 +1786,23 @@ CONTEXT: processing remote data for replication origin "pg_16395" during "INSER </para> <para> + If the subscription has been configured with + <literal>run_as_owner = true</literal>, then no user switching will + occur. Instead, all operations will be performed with the permissions + of the subscription owner. In this case, the subscription owner only + needs privileges to <literal>SELECT</literal>, <literal>INSERT</literal>, + <literal>UPDATE</literal>, and <literal>DELETE</literal> from the + target table, and does not need privileges to <literal>SET ROLE</literal> + to the table owner. However, this also means that any user who owns + a table into which replication is happening can execute arbitrary code with + the privileges of the subscription owner. For example, they could do this + by simply attaching a trigger to one of the tables which they own. + Because it is usually undesirable to allow one role to freely assume + the privileges of another, this option should be avoided unless user + security within the database is of no concern. + </para> + + <para> On the publisher, privileges are only checked once at the start of a replication connection and are not re-checked as each change record is read. </para> diff --git a/doc/src/sgml/ref/alter_subscription.sgml b/doc/src/sgml/ref/alter_subscription.sgml index df88e975375..a85e04e4d6d 100644 --- a/doc/src/sgml/ref/alter_subscription.sgml +++ b/doc/src/sgml/ref/alter_subscription.sgml @@ -224,7 +224,8 @@ ALTER SUBSCRIPTION <replaceable class="parameter">name</replaceable> RENAME TO < <link linkend="sql-createsubscription-with-binary"><literal>binary</literal></link>, <link linkend="sql-createsubscription-with-streaming"><literal>streaming</literal></link>, <link linkend="sql-createsubscription-with-disable-on-error"><literal>disable_on_error</literal></link>, - <link linkend="sql-createsubscription-with-password-required"><literal>password_required</literal></link>, and + <link linkend="sql-createsubscription-with-password-required"><literal>password_required</literal></link>, + <link linkend="sql-createsubscription-with-run-as-owner"><literal>run_as_owner</literal></link>, and <link linkend="sql-createsubscription-with-origin"><literal>origin</literal></link>. Only a superuser can set <literal>password_required = false</literal>. </para> diff --git a/doc/src/sgml/ref/create_subscription.sgml b/doc/src/sgml/ref/create_subscription.sgml index 2e4105d36e9..68aa2b47f2d 100644 --- a/doc/src/sgml/ref/create_subscription.sgml +++ b/doc/src/sgml/ref/create_subscription.sgml @@ -366,6 +366,20 @@ CREATE SUBSCRIPTION <replaceable class="parameter">subscription_name</replaceabl </listitem> </varlistentry> + <varlistentry id="sql-createsubscription-with-run-as-owner"> + <term><literal>run_as_owner</literal> (<type>string</type>)</term> + <listitem> + <para> + If true, all replication actions are performed as the subscription + owner. If false, replication workers will perform actions on each + table as the owner of that table. The latter configuration is + generally much more secure; for details, see + <xref linkend="logical-replication-security" />. + The default is <literal>false</literal>. + </para> + </listitem> + </varlistentry> + <varlistentry id="sql-createsubscription-with-origin"> <term><literal>origin</literal> (<type>string</type>)</term> <listitem> |